Two-node reverse proxy HA on Windows without pretending it is a cluster

Verified 2026-10-291 min read

Design an active/passive or DNS/LB fronted pair, keep configuration identical, handle sessions and health, and know the limits versus NLB.

Tested onStandard / Datacenter · Build 26100.33650 · x64

Build: 26100.33650
Edition: Standard / Datacenter
Architecture: x64
Support: Documentation (E1)
Evidence: E1Official documentation
Verified: 2026-10-29
Page type: Concept

The short answer

HA is not “two servers”. It needs:

a shared front (DNS round-robin with health, a load balancer, or NLB);
identical configuration on both nodes;
a session model (sticky, shared cache, or stateless tokens);
certificate/config distribution;
a tested failover and a split-brain story.

A single Windows box with two Nginx processes is not HA.

Topologies

Pattern	Use	Limit
DNS round-robin	quick, cheap	no health, client caching
External LB / cloud LB	most production	extra hop/cost
Windows NLB	on-prem pair	unicast/multicast quirks, not a WAF
ARR/Nginx pair behind LB	TLS + routing	LB is still the SPOF unless redundant

If the LB is one VM, you moved the SPOF, not removed it.

Configuration consistency

Keep both nodes’ IIS/Nginx config in version control.
IIS: shared configuration on a highly available share, or deploy the same applicationHost.config/site XML.
Nginx: same nginx.conf + includes; deploy with checksum verification.
Certificates: same PFX/PEM, same renewal automation, same reload.
App versions: same artifact hash on both nodes.

Sessions

Prefer stateless (JWT/signed cookie) or a shared cache (Redis).
Sticky sessions work but break on failover unless the session store is shared.
IIS/ASP.NET session state in a shared store, not in-proc, for multi-node.

Health and failover

Probe /readyz from the LB.
Remove a node on N consecutive failures; add back slowly.
Test failover in business hours, not only at 3am.
Alert on node count/health, not just per-node CPU.

Verify

# from the LB/host, both nodes answer
curl.exe -I https://lab.example/ --resolve lab.example:443:<node1>
curl.exe -I https://lab.example/ --resolve lab.example:443:<node2>
Get-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter 'system.webServer/rewrite/rules' -Name '.'

Stop one node; the site should stay up and the LB should remove it. If it does not, you have a diagram, not HA.

Lab boundary

E1. The lab is a single VM; no LB or second node was built. The topologies are the design to validate on Server 2025.